The Privacy Rule standards in HIPAA address the use and disclosure of individuals’ health information—called “protected health information” by organizations subject to the Privacy Rule — called “covered entities,” as well as standards for individuals’ privacy rights to understand and control how their health information is used. Within HHS, the Office for Civil Rights (“OCR”) has responsibility for implementing and enforcing the Privacy Rule with respect to voluntary compliance activities and civil money penalties. A major goal of the Privacy Rule is to assure that individuals’ health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care and to protect the public’s health and well being.This is a summary of key elements of the Privacy Rule and not a complete or comprehensive guide to compliance. To review the entire Rule itself, and for other additional helpful information about how it applies, see the OCR website: www.hhs.gov/ocr/hipaa.
This policy is effective as of May 2022.